13.12.Â Process Accounting

Contributed
by TomRhodes.

Process accounting is a security method in which an
administrator may keep track of system resources used and
their allocation among users, provide for system monitoring,
and minimally track a user's commands.

Process accounting has both positive and negative points.
One of the positives is that an intrusion may be narrowed down
to the point of entry. A negative is the amount of logs
generated by process accounting, and the disk space they may
require. This section walks an administrator through the basics
of process accounting.

13.12.1.Â Enabling and Utilizing Process Accounting

Once enabled, accounting will begin to track information
such as CPU statistics and executed
commands. All accounting logs are in a non-human readable
format which can be viewed using sa. If
issued without any options, sa prints
information relating to the number of per-user calls, the
total elapsed time in minutes, total CPU
and user time in minutes, and the average number of
I/O operations. Refer to sa(8) for
the list of available options which control the output.

To display the commands issued by users, use
lastcomm. For example, this command
prints out all usage of ls by trhodes on the
ttyp1 terminal: